# Elastic Agent **URL:** https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=9 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 10 --- ## [Windows ETW logs (DNSServer Analytics logs) not getting ingested](https://discuss.elastic.co/t/windows-etw-logs-dnsserver-analytics-logs-not-getting-ingested/368606)
**Author:** [@suhasbhatt101](https://discuss.elastic.co/u/suhasbhatt101)\ **Replies:** 11\ **Last updated:** [March 20, 2025, 2:21pm UTC](https://discuss.elastic.co/t/windows-etw-logs-dnsserver-analytics-logs-not-getting-ingested/368606 "2025-03-20T14:21:38Z")
I am trying to ingest DNSServer Analytics logs to my ELK stack (V-8.14) but the logs are not getting ingested, below is the configurations i added in my elastic-agent.yml file: Trial 1: - type: etw id: etw-dnss… --- ## [Resolving hostname while installing Elastic Agent](https://discuss.elastic.co/t/resolving-hostname-while-installing-elastic-agent/376050)
**Author:** [@r00t](https://discuss.elastic.co/u/r00t)\ **Replies:** 0\ **Last updated:** [March 18, 2025, 8:19am UTC](https://discuss.elastic.co/t/resolving-hostname-while-installing-elastic-agent/376050 "2025-03-18T08:19:08Z")
Hi community. I had a setup to access interface via hostname instead of IP adress. While trying to deploying agents on Windows machines via ELASTIC FLEET they can not resolve. I know editing the hosts file will fix pro… --- ## [Does elastic-agent enrolled in fleet with system integration needs port opened to elasticsearch nodes?](https://discuss.elastic.co/t/does-elastic-agent-enrolled-in-fleet-with-system-integration-needs-port-opened-to-elasticsearch-nodes/375992)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 1\ **Last updated:** [March 17, 2025, 2:54pm UTC](https://discuss.elastic.co/t/does-elastic-agent-enrolled-in-fleet-with-system-integration-needs-port-opened-to-elasticsearch-nodes/375992 "2025-03-17T14:54:48Z")
I have a 3 elasticsearch nodes, 1 elastic agent fleet server node, and 8 elastic-agent server. The elastic-agent have custom logs and system integration. I have opened ports from elastic agent to fleet server. Does the e… --- ## [Installing elastic Agent in a path other than /opt/](https://discuss.elastic.co/t/installing-elastic-agent-in-a-path-other-than-opt/375928)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 2\ **Last updated:** [March 14, 2025, 1:57pm UTC](https://discuss.elastic.co/t/installing-elastic-agent-in-a-path-other-than-opt/375928 "2025-03-14T13:57:43Z")
Hello everyone, As I am not the person in charge of administering the servers I have to make a request by mail to the administrator to install the agent. The answer he gave me was that it has no space in /opt/ and I mu… --- ## [Deploying and enrolling an agent using ansible. (Ansible-lint failure)](https://discuss.elastic.co/t/deploying-and-enrolling-an-agent-using-ansible-ansible-lint-failure/375897)
**Author:** [@Joey\_Visbeen](https://discuss.elastic.co/u/Joey_Visbeen)\ **Replies:** 1\ **Last updated:** [March 14, 2025, 11:33am UTC](https://discuss.elastic.co/t/deploying-and-enrolling-an-agent-using-ansible-ansible-lint-failure/375897 "2025-03-14T11:33:13Z")
For the installation of the agent on a Linux server I use RPM. This involves using yum. After which the downloaded agent needs to be enrolled. The command in Ansible in straight forward, but Ansible-lint blocks it becaus… --- ## [Seeking Advice on Hardware Specifications for ELK-based Log Monitoring System](https://discuss.elastic.co/t/seeking-advice-on-hardware-specifications-for-elk-based-log-monitoring-system/375888)
**Author:** [@yt.seo](https://discuss.elastic.co/u/yt.seo)\ **Replies:** 0\ **Last updated:** [March 14, 2025, 5:53am UTC](https://discuss.elastic.co/t/seeking-advice-on-hardware-specifications-for-elk-based-log-monitoring-system/375888 "2025-03-14T05:53:30Z")
Hello, I am planning to set up an ELK-based log monitoring system on internal servers and would appreciate some guidance on determining the appropriate hardware specifications. I am looking for advice on hardware requi… --- ## [Osquery, Yara and Sigfile](https://discuss.elastic.co/t/osquery-yara-and-sigfile/371816)
**Author:** [@DiscussArb](https://discuss.elastic.co/u/DiscussArb)\ **Replies:** 1\ **Last updated:** [March 13, 2025, 2:39pm UTC](https://discuss.elastic.co/t/osquery-yara-and-sigfile/371816 "2025-03-13T14:39:45Z")
I have a bunch of Yara rules that I would like to run on demand using the Yara table in Osquery. Is it possible to use the sigfile parameter, and if so, where should the file be stored so that Osquery finds the sigfile w… --- ## [Error during checkin with fleet-server](https://discuss.elastic.co/t/error-during-checkin-with-fleet-server/375776)
**Author:** [@geo5](https://discuss.elastic.co/u/geo5)\ **Replies:** 0\ **Last updated:** [March 12, 2025, 11:14am UTC](https://discuss.elastic.co/t/error-during-checkin-with-fleet-server/375776 "2025-03-12T11:14:47Z")
I am trying to enroll an Elastic Agent with Elasticsearch, but my agent is in a Kubernetes cluster. I am using the same YAML that Kibana generated for me, but my container shows this error: {"log.level":"warn","@timesta… --- ## [Elastic Endpoint service failed (missed 3 check-ins)](https://discuss.elastic.co/t/elastic-endpoint-service-failed-missed-3-check-ins/375726)
**Author:** [@daniel.velinov](https://discuss.elastic.co/u/daniel.velinov)\ **Replies:** 1\ **Last updated:** [March 11, 2025, 4:37pm UTC](https://discuss.elastic.co/t/elastic-endpoint-service-failed-missed-3-check-ins/375726 "2025-03-11T16:37:00Z")
Hello I have been having issues with Elastic Agents on my Proxmox hosts (Debian12) and in particular the Endpoint integration that fails to become Healthy. All other integrations, like packet capture and system logs are… --- ## [Elastic Fleet Server installed, but doesnt show up as fleet server](https://discuss.elastic.co/t/elastic-fleet-server-installed-but-doesnt-show-up-as-fleet-server/375705)
**Author:** [@rara01](https://discuss.elastic.co/u/rara01)\ **Replies:** 1\ **Last updated:** [March 11, 2025, 2:23pm UTC](https://discuss.elastic.co/t/elastic-fleet-server-installed-but-doesnt-show-up-as-fleet-server/375705 "2025-03-11T14:23:23Z")
Hi, I have installed fleet server in docker based on docker tutorial. I have agent showing up in Fleet, with fleet server policy and fleet server integrations. However, when i want to add agent, it shows that i dont hav… --- ## [Osquerybeat Permission Error - No Queries possible](https://discuss.elastic.co/t/osquerybeat-permission-error-no-queries-possible/371400)
**Author:** [@matled](https://discuss.elastic.co/u/matled)\ **Replies:** 4\ **Last updated:** [March 10, 2025, 12:27pm UTC](https://discuss.elastic.co/t/osquerybeat-permission-error-no-queries-possible/371400 "2025-03-10T12:27:57Z")
We are using Elastic-Stack 8.16.1 and also Elastic-Agents 8.16.1 integrated in Elastic Fleet. Currently, we are having problems with Osquery on Windows Systems where we traced the problem down to the following errors: … --- ## [Storing apm logs in file](https://discuss.elastic.co/t/storing-apm-logs-in-file/375446)
**Author:** [@Alex21](https://discuss.elastic.co/u/Alex21)\ **Replies:** 0\ **Last updated:** [March 5, 2025, 10:14am UTC](https://discuss.elastic.co/t/storing-apm-logs-in-file/375446 "2025-03-05T10:14:28Z")
I am using the Elastic APM Java agent with WildFly. Is it possible to store only APM event logs (such as request-response time) in a file instead of sending them to the APM server? I tried using -Delastic.apm.log\_file … --- ## [Installing agent fail](https://discuss.elastic.co/t/installing-agent-fail/375326)
**Author:** [@Msquared](https://discuss.elastic.co/u/Msquared)\ **Replies:** 0\ **Last updated:** [March 3, 2025, 6:50pm UTC](https://discuss.elastic.co/t/installing-agent-fail/375326 "2025-03-03T18:50:08Z")
Hi All, I am trying to install agents on windows endpoints in my org but getting the following error, I am running PowerShell/command prompt as admin, but still seems to fail. "\[ \] Installing Elastic Agent... \[0s\] … --- ## [Elastic Agent to Azure Event Hub RBAC/OAuth2 input plugin support](https://discuss.elastic.co/t/elastic-agent-to-azure-event-hub-rbac-oauth2-input-plugin-support/375316)
**Author:** [@miksonx](https://discuss.elastic.co/u/miksonx)\ **Replies:** 0\ **Last updated:** [March 3, 2025, 2:58pm UTC](https://discuss.elastic.co/t/elastic-agent-to-azure-event-hub-rbac-oauth2-input-plugin-support/375316 "2025-03-03T14:58:09Z")
Hi, As noticed on the documentation for Elastic Agent input plugin to Azure Event Hub only support "connection\_string". As security regulations require us to use RBAC/OAuth2 is there a plan to implement this functionali… --- ## [Filtering Logs by Server Groups in Fleet-Managed Agents](https://discuss.elastic.co/t/filtering-logs-by-server-groups-in-fleet-managed-agents/375067)
**Author:** [@gaimes410](https://discuss.elastic.co/u/gaimes410)\ **Replies:** 6\ **Last updated:** [March 2, 2025, 12:04pm UTC](https://discuss.elastic.co/t/filtering-logs-by-server-groups-in-fleet-managed-agents/375067 "2025-03-02T12:04:50Z")
Hi everyone! In our R&D environment, we frequently create and destroy Windows and Linux servers, which we enroll into Fleet using the Elastic Agent. Each server group is assigned a randomly generated name that users rec… --- ## [Monitoring Multiple Windows Event Channels with Custom Event Logs in ELK Stack](https://discuss.elastic.co/t/monitoring-multiple-windows-event-channels-with-custom-event-logs-in-elk-stack/375134)
**Author:** [@ValentinL](https://discuss.elastic.co/u/ValentinL)\ **Replies:** 1\ **Last updated:** [March 2, 2025, 8:24am UTC](https://discuss.elastic.co/t/monitoring-multiple-windows-event-channels-with-custom-event-logs-in-elk-stack/375134 "2025-03-02T08:24:12Z")
Hello everyone, I have an ELK stack to monitor various Windows events. I monitor my agents with the Fleet server and integrations. I frequently use the "Custom Windows Event Logs" to target specific Event IDs I need. I… --- ## [Pipeline not found for AWS integration on Agent managed by Fleet](https://discuss.elastic.co/t/pipeline-not-found-for-aws-integration-on-agent-managed-by-fleet/375156)
**Author:** [@NeilSmith](https://discuss.elastic.co/u/NeilSmith)\ **Replies:** 3\ **Last updated:** [February 27, 2025, 2:23pm UTC](https://discuss.elastic.co/t/pipeline-not-found-for-aws-integration-on-agent-managed-by-fleet/375156 "2025-02-27T14:23:50Z")
Using Fleet to manage an agent with the AWS integration. Ingest and indexing is OK, getting tens of millions of logs from Transit Gateway via Cloudwatch, but they are not being processed through the ingest pipeline creat… --- ## [Elastic Agent - Metricbeat events being dropped with status code 400](https://discuss.elastic.co/t/elastic-agent-metricbeat-events-being-dropped-with-status-code-400/375141)
**Author:** [@Muhammadh\_Zakir\_Huss](https://discuss.elastic.co/u/Muhammadh_Zakir_Huss)\ **Replies:** 0\ **Last updated:** [February 27, 2025, 9:23am UTC](https://discuss.elastic.co/t/elastic-agent-metricbeat-events-being-dropped-with-status-code-400/375141 "2025-02-27T09:23:57Z")
I am trying to install a fleet managed elastic agent on a freshly installed ubuntu server. Elastic agent installation is successfull but I am not getting any events to Kibana. When I went through the logs, I was able to… --- ## [Multiple Syslog Sources Configuration on Single Elastic Agent Port, port 514](https://discuss.elastic.co/t/multiple-syslog-sources-configuration-on-single-elastic-agent-port-port-514/375109)
**Author:** [@IsaacZhu](https://discuss.elastic.co/u/IsaacZhu)\ **Replies:** 6\ **Last updated:** [February 27, 2025, 12:47am UTC](https://discuss.elastic.co/t/multiple-syslog-sources-configuration-on-single-elastic-agent-port-port-514/375109 "2025-02-27T00:47:45Z")
Current Setup: Elastic Agent collecting syslog messages from: Aruba access points and switches (Custom UDP integration) F5 VPN (Custom UDP integration) Fortigate firewalls (Fortigate Syslog integration) All configur… --- ## [Unable to upgrade Elastic Agents installed on Azure AKS which are managed by Fleet](https://discuss.elastic.co/t/unable-to-upgrade-elastic-agents-installed-on-azure-aks-which-are-managed-by-fleet/375066)
**Author:** [@mattyanyan.work](https://discuss.elastic.co/u/mattyanyan.work)\ **Replies:** 2\ **Last updated:** [February 26, 2025, 2:44pm UTC](https://discuss.elastic.co/t/unable-to-upgrade-elastic-agents-installed-on-azure-aks-which-are-managed-by-fleet/375066 "2025-02-26T14:44:19Z")
I have an AKS cluster and I have installed Elastic Agents on the cluster by following this documentation: Run Elastic Agent on Azure AKS managed by Fleet | Fleet and Elastic Agent Guide \[8.17\] | Elastic Recently, I trie… --- ## [Elastic-Agent is healthy or offline](https://discuss.elastic.co/t/elastic-agent-is-healthy-or-offline/374899)
**Author:** [@seyed\_amir](https://discuss.elastic.co/u/seyed_amir)\ **Replies:** 7\ **Last updated:** [February 26, 2025, 1:12pm UTC](https://discuss.elastic.co/t/elastic-agent-is-healthy-or-offline/374899 "2025-02-26T13:12:20Z")
Hello, I installed Fleet Server in the cluster and then installed several Windows and Linux agents. The status of all is healthy, but every few minutes these agents are displayed as offline. Although they are sending log… --- ## [Fleet allows agent upgrades higher than cluster version](https://discuss.elastic.co/t/fleet-allows-agent-upgrades-higher-than-cluster-version/375014)
**Author:** [@djkprojects](https://discuss.elastic.co/u/djkprojects)\ **Replies:** 2\ **Last updated:** [February 25, 2025, 2:06pm UTC](https://discuss.elastic.co/t/fleet-allows-agent-upgrades-higher-than-cluster-version/375014 "2025-02-25T14:06:41Z")
Hello, In previous versions of Elastic the highest available version for upgrading Elastic Agent in fleet was the version of the cluster itself however the newer versions allow upgrading to the latest release version. I… --- ## [Elastic Defend Policy - Performance impact of configs](https://discuss.elastic.co/t/elastic-defend-policy-performance-impact-of-configs/374369)
**Author:** [@Ziyi26](https://discuss.elastic.co/u/Ziyi26)\ **Replies:** 3\ **Last updated:** [February 24, 2025, 5:24pm UTC](https://discuss.elastic.co/t/elastic-defend-policy-performance-impact-of-configs/374369 "2025-02-24T17:24:38Z")
Hi there, We want to minimize specifically the Elastic Defend Policies due to the size of our estate. One easy way is to have 1 policy for both Windows and Linux hosts. How does Elastic Defend work when you configure i… --- ## [Different source of logs at same port 514 at elastic-agent VM](https://discuss.elastic.co/t/different-source-of-logs-at-same-port-514-at-elastic-agent-vm/374789)
**Author:** [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\ **Replies:** 1\ **Last updated:** [February 23, 2025, 7:10pm UTC](https://discuss.elastic.co/t/different-source-of-logs-at-same-port-514-at-elastic-agent-vm/374789 "2025-02-23T19:10:03Z")
Hello , I am receiving different type of logs eg. cisco ise logs , pfsense logs, epp logs at single server via syslog-ng at same port 514 . I have set up elastic agent at this VM to integration and receiving logs , but … --- ## [AD Entity Analytics - invalid memory address or nil pointer dereference](https://discuss.elastic.co/t/ad-entity-analytics-invalid-memory-address-or-nil-pointer-dereference/374855)
**Author:** [@meganl](https://discuss.elastic.co/u/meganl)\ **Replies:** 2\ **Last updated:** [February 21, 2025, 3:01pm UTC](https://discuss.elastic.co/t/ad-entity-analytics-invalid-memory-address-or-nil-pointer-dereference/374855 "2025-02-21T15:01:21Z")
A few weeks ago, the AD Entity Analytics integration stopped ingesting any data. This happened around the time we updated Elastic from 8.15.3 to 8.15.5. It seems that after updating Elastic, the incremental updates were … --- ## [Memory Leak - Weblogic Server](https://discuss.elastic.co/t/memory-leak-weblogic-server/374847)
**Author:** [@Cadu\_Souza](https://discuss.elastic.co/u/Cadu_Souza)\ **Replies:** 0\ **Last updated:** [February 21, 2025, 11:17am UTC](https://discuss.elastic.co/t/memory-leak-weblogic-server/374847 "2025-02-21T11:17:12Z")
Hi everyone, I am facing an issue on a WebLogic server running Java 8 with the latest version of the APM agent installed. The JVM has been experiencing a memory leak problem after two days of use without a reset. After… --- ## [IIS Worker Process Requests Elapsed Time](https://discuss.elastic.co/t/iis-worker-process-requests-elapsed-time/374805)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 0\ **Last updated:** [February 20, 2025, 11:12am UTC](https://discuss.elastic.co/t/iis-worker-process-requests-elapsed-time/374805 "2025-02-20T11:12:41Z")
Hi Team, I am attaching a screenshot below for IIS Worker Process Requests Elapsed Time from the Windows system. We are using IIS integration to pull IIS metrics and logs with elastic version 8.13. In the above scr… --- ## [Install size Elastic Agent](https://discuss.elastic.co/t/install-size-elastic-agent/374801)
**Author:** [@peter.verhage](https://discuss.elastic.co/u/peter.verhage)\ **Replies:** 1\ **Last updated:** [February 20, 2025, 1:23pm UTC](https://discuss.elastic.co/t/install-size-elastic-agent/374801 "2025-02-20T13:23:07Z")
We replaced all of the filebeat and winlogbeat agents with Elastic Agent, in order to better manage versions. Currently we are using version 8.17.2 after an upgrade from 8.17.1. We ran into some issues with upgrades of … --- ## [Network Packet Capture integration stuck in a FAILED state](https://discuss.elastic.co/t/network-packet-capture-integration-stuck-in-a-failed-state/374767)
**Author:** [@pok\_lehbim](https://discuss.elastic.co/u/pok_lehbim)\ **Replies:** 1\ **Last updated:** [February 20, 2025, 10:59am UTC](https://discuss.elastic.co/t/network-packet-capture-integration-stuck-in-a-failed-state/374767 "2025-02-20T10:59:17Z")
I am trying to add the Network Packet Capture integration to an agent but it's not working at all. The machine is a windows host, and it's managed from a fleet. I've looked into the logs but there isn't any pertinent in… --- ## [Extremely increased disk usage since upgrade to 8.17.1](https://discuss.elastic.co/t/extremely-increased-disk-usage-since-upgrade-to-8-17-1/374405)
**Author:** [@Alphayeeeet](https://discuss.elastic.co/u/Alphayeeeet)\ **Replies:** 39\ **Last updated:** [February 19, 2025, 8:46pm UTC](https://discuss.elastic.co/t/extremely-increased-disk-usage-since-upgrade-to-8-17-1/374405 "2025-02-19T20:46:39Z")
Hi, we upgraded our production stack to 8.17.1 at the beginning of the week. Now after it ran for a few days the amount of data (especially Kubernetes cluster metrics) has been increased enormously since the upgrade. … [Previous page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=8) [Next page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=10)